voidtools forum

VoidTools - Everything appears to be a sensible tool to consider for cyberforensics.

The only downside is the lack of content search, to this end i seek how to extend the functionality using iFilters.

Essentially the search functionality of everything will show up the kind of files we need to identify based on the filetype and/or extension or checksum value (md5/sha1/sha256) Only in a second step where files are already filtered searching contents makes sense.

To this end i hope to better understand how to enable ifilter for voidtools so i can search contents for selected files, this can be slower.

I hope to hear from you.

Thank you,

JL

To search with ifilters, use the content: search function.

For example:

*.pdf dm:thisyear content:"text in file search"

Note: File content is not indexed. Searching file content will be very slow.
For the best performance, combine the content: search with other search filters.

Please try the Advanced Search under the search menu and set the "A word or phrase in the file" field.
For the best performance, set as many fields in the Advanced Search as possible.

I don't understand this discussion ?
The current Everything 1.5 alpha version has content indexing and uses IFilters for it.

You can add a column to display; MD5 SHA1 SHA512, or whatever.
(Right-click a column, Content -> SHA-1.)
If you keep that column outside of the current view, i.e., such that you have to scroll to the right to see it, it will (lazy) load the hashes, only as you bring them into view.

So if you search for Trains, then filter that search to Red Trains, then scroll to the right, the hashes for Red Trains will then display.

Alternatively...

that will index all, or a subset of files (based on any filtering that you enter [in that dialog]).